)]}'
{
  "commit": "ef0c067405ff6956b986d853c39c609e6d457228",
  "tree": "73e2a474e5fcfcc223a8cebf6dde70e0bc469e80",
  "parents": [
    "0767932bbeb83bea1287ab029f9fe5c4d336dbb9",
    "acb7cf4c1184e27622be0faf89244d5001ed1e87"
  ],
  "author": {
    "name": "Kevin Berry",
    "email": "kpberry@google.com",
    "time": "Wed Jun 10 23:53:10 2026 +0000"
  },
  "committer": {
    "name": "Kevin Berry",
    "email": "kpberry@google.com",
    "time": "Fri Jun 12 18:45:09 2026 -0700"
  },
  "message": "merge-upstream/v6.18.35 from branch/tag: upstream/v6.18.35 into branch: cos-6.18\n\nConflicts:\n net/core/devmem.c\n\nChangelog:\n-------------------------------------------------------------\n\nAbdurrahman Hussain (2):\n      hwmon: (pmbus/adm1266) serialize sequencer_state debugfs read with pmbus_lock\n      hwmon: (pmbus/adm1266) serialize GPIO PMBus accesses with pmbus_lock\n\nAdvait Dhamorikar (1):\n      iio: magnetometer: st_magn: fix default DRDY pin selection for LIS2MDL\n\nAldo Conte (1):\n      iio: light: cm3323: fix reg_conf not being initialized correctly\n\nAlexander Stein (1):\n      gpio: mxc: fix irq_high handling\n\nAlexandra Winter (1):\n      net/smc: Do not re-initialize smc hashtables\n\nAlexandre Ghiti (1):\n      mm: memcontrol: propagate NMI slab stats to memcg vmstats\n\nAlexandru Hossu (1):\n      scsi: target: iscsi: Validate CHAP_R length before base64 decode\n\nAlexis Lothoré (eBPF Foundation) (1):\n      x86/ftrace: Relocate %rip-relative percpu refs in dynamic trampolines\n\nAli Ganiyev (1):\n      ksmbd: OOB read regression in smb_check_perm_dacl() ACE-walk loops\n\nAlice Ryhl (1):\n      rust_binder: avoid calling pending_oneway_finished() on TF_UPDATE_TXN\n\nAndrei Vagin (1):\n      Revert \"x86/fpu: Refine and simplify the magic number check during signal return\"\n\nAntoniu Miclaus (2):\n      iio: gyro: adis16260: fix division by zero in write_raw\n      iio: chemical: scd30: fix division by zero in write_raw\n\nArnd Bergmann (1):\n      iommu, debugobjects: avoid gcc-16.1 section mismatch warnings\n\nAshutosh Desai (1):\n      nfc: hci: fix out-of-bounds read in HCP header parsing\n\nBalasubramani Vivekanandan (1):\n      drm/xe: Restore IDLEDLY regiter on engine reset\n\nBartosz Golaszewski (1):\n      gpio: adnp: fix flow control regression caused by scoped_guard()\n\nBen Hutchings (1):\n      parport: Fix race between port and client registration\n\nBenoît Monin (1):\n      iio: buffer: Fix DMA fence leak in iio_buffer_enqueue_dmabuf()\n\nBerkant Koc (2):\n      drm/hyperv: validate resolution_count and fix WIN8 fallback\n      drm/hyperv: validate VMBus packet size in receive callback\n\nBjörn Töpel (1):\n      net: Avoid checksumming unreadable skb tail on trim\n\nBreno Leitao (1):\n      net/iucv: fix locking in .getsockopt\n\nCarl Lee (1):\n      nfc: nxp-nci: i2c: use rising-edge IRQ on ACPI systems\n\nChaitanya Sabnis (1):\n      i2c: davinci: fix division by zero on missing clock-frequency\n\nChris Mason (1):\n      netfilter: synproxy: refresh tcphdr after skb_ensure_writable\n\nChristian König (1):\n      drm/amdgpu: fix calling VM invalidation in amdgpu_hmm_invalidate_gfx\n\nChristofer Jonason (1):\n      iio: adc: xilinx-xadc: Fix sequencer mode in postdisable for dual mux\n\nChuck Lever (3):\n      net/handshake: Use spin_lock_bh for hn_lock\n      nvme-tcp: store negative errno in queue-\u003etls_err\n      net/handshake: Pass negative errno through handshake_complete()\n\nCássio Gabriel (4):\n      ALSA: pcm: oss: Fix setup list UAF on proc write error\n      ASoC: Intel: bytcht_es8316: Fix MCLK leak on init errors\n      ASoC: codecs: simple-mux: Fix enum control bounds check\n      ALSA: firewire-motu: Protect register DSP event queue positions\n\nDan Carpenter (3):\n      gpio: virtuser: Fix uninitialized data bug in gpio_virtuser_direction_do_write()\n      usb: dwc2: Fix use after free in debug code\n      usb: typec: tipd: Fix error code in tps6598x_probe()\n\nDavid Ahern (1):\n      xfrm: Check for underflow in xfrm_state_mtu\n\nDavid Carlier (3):\n      iio: adc: npcm: fix unbalanced clk_disable_unprepare()\n      iio: gyro: itg3200: fix i2c read into the wrong stack location\n      net: devmem: reject dma-buf bind with non-page-aligned size or SG length\n\nDavid E. Box (2):\n      platform/x86/intel/vsec: Refactor base_addr handling\n      platform/x86/intel/vsec: Make driver_data info const\n\nDavid Francis (1):\n      drm/amdkfd: Check for pdd drm file first in CRIU restore path\n\nDavid Howells (2):\n      rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg\n      rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer\n\nDavid Jeffery (1):\n      scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues\n\nDavide Caratti (1):\n      net/sched: cls_fw: fix NULL dereference of \"old\" filters before change()\n\nDawei Feng (1):\n      octeontx2-pf: avoid double free of pool-\u003estack on AQ init failure\n\nDev Jain (1):\n      mm/rmap: initialize nr_pages to 1 at loop start in try_to_unmap_one\n\nDhabaleshwar Das (1):\n      accel/rocket: fix UAF via dangling GEM handle in create_bo\n\nDipayaan Roy (2):\n      net: mana: Add NULL guards in teardown path to prevent panic on attach failure\n      net: mana: Skip redundant detach on already-detached port\n\nDmitriy Zharov (1):\n      Input: xpad - add support for ASUS ROG RAIKIRI II\n\nDmitry Torokhov (3):\n      Input: xpad - fix out-of-bounds access for Share button\n      Input: elan_i2c - validate firmware size before use\n      Input: atmel_mxt_ts - fix boundary check in mxt_prepare_cfg_mem\n\nDoruk Tan Ozturk (1):\n      Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync\n\nEric Dumazet (4):\n      ipv4: free net-\u003eipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table()\n      tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]()\n      vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu()\n      tunnels: do not assume transport header in iptunnel_pmtud_check_icmp()\n\nEric Huang (2):\n      drm/amdkfd: fix NULL pointer bug in svm_range_set_attr\n      drm/amdkfd: fix a vulnerability of integer overflow in kfd debugger\n\nFelix Gu (2):\n      iio: light: veml6070: Fix resource leak in probe error path\n      iio: buffer: hw-consumer: fix use-after-free in error path\n\nFernando Fernandez Mancera (1):\n      netfilter: nf_tables: fix dst corruption in same register operation\n\nFlorian Schmaus (1):\n      kunit: fix use-after-free in debugfs when using kunit.filter\n\nFlorian Westphal (2):\n      netfilter: xt_cpu: prefer raw_smp_processor_id\n      netfilter: ebtables: fix OOB read in compat_mtw_from_user\n\nGeoffrey D. Bennett (1):\n      ALSA: scarlett2: Fix 2i2 Gen 4 direct monitor gain on firmware 2417\n\nGreg Kroah-Hartman (13):\n      Input: usbtouchscreen - clamp NEXIO data_len/x_len to URB buffer size\n      iio: imu: st_lsm6dsx: fix stack leak in tagged FIFO buffer\n      iio: imu: adis16550: fix stack leak in trigger handler\n      iio: pressure: bmp280: fix stack leak in bmp580 trigger handler\n      usb: typec: ucsi: ccg: reject firmware images without a \u0027:\u0027 record header\n      usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers\n      usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes()\n      usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO\n      usb: typec: altmodes/displayport: validate count before reading Status Update VDO\n      usb: typec: wcove: don\u0027t write past struct pd_message in wcove_read_rx_buffer()\n      usb: typec: tcpm/tcpci_maxim: validate header NDO against RX_BYTE_CNT\n      usb: typec: ucsi: validate connector number in ucsi_connector_change()\n      Linux 6.18.35\n\nGuangshuo Li (3):\n      counter: Fix refcount leak in counter_alloc() error path\n      usb: gadget: net2280: Fix double free in probe error path\n      usb: gadget: f_hid: fix device reference leak in hidg_alloc()\n\nGuenter Roeck (1):\n      hwmon: (pmbus) Add support for guarded PMBus lock\n\nHamza Mahfooz (1):\n      netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check\n\nHeitor Alves de Siqueira (4):\n      Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close\n      Bluetooth: hci_sync: Reset device counters in hci_dev_close_sync()\n      usb: usbtmc: check URB actual_length for interrupt-IN notifications\n      usb: usbtmc: reject interrupt endpoints with small wMaxPacketSize\n\nHenri A (1):\n      media: rc: igorplugusb: fix control request setup packet\n\nHerbert Xu (1):\n      xfrm: ipcomp: Free destination pages on acomp errors\n\nHongling Zeng (1):\n      serial: sh-sci: fix memory region release in error path\n\nHongtao Lee (1):\n      tools/bootconfig: Fix buf leaks in apply_xbc\n\nHoratiu Vultur (1):\n      phy: mscc: Use PHY_ID_MATCH_EXACT for VSC8584, VSC8582, VSC8575, VSC856X\n\nHyunwoo Kim (2):\n      KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry\n      KVM: arm64: Reassign nested_mmus array behind mmu_lock\n\nIan Abbott (2):\n      comedi: comedi_test: fix check for valid scan_begin_src in waveform_ai_cmdtest()\n      comedi: comedi_test: Fix limiting of convert_arg in waveform_ai_cmdtest()\n\nIdo Schimmel (2):\n      bridge: Fix sleep in atomic context in netlink path\n      bridge: Fix sleep in atomic context in sysfs path\n\nIlya Maximets (2):\n      net: netlink: fix sending unassigned nsid after assigned one\n      net: netlink: don\u0027t set nsid on local notifications\n\nJacques Nilo (3):\n      serial: core: introduce guard(uart_port_lock_check_sysrq_irqsave)\n      serial: 8250: dispatch SysRq character in serial8250_handle_irq()\n      serial: 8250_dw: dispatch SysRq character in dw8250_handle_irq()\n\nJakub Kicinski (26):\n      ethtool: rss: avoid modifying the RSS context response\n      ethtool: rss: add missing errno on RSS context delete\n      ethtool: rss: fix falsely ignoring indir table updates\n      ethtool: rss: fix indir_table and hkey leak on get_rxfh failure\n      ethtool: rss: fix hkey leak when indir_size is 0\n      ethtool: rss: avoid device context leak on reply-build failure\n      ethtool: module: call ethnl_ops_complete() on module flash errors\n      ethtool: module: avoid leaking a netdev ref on module flash errors\n      ethtool: module: avoid racy updates to dev-\u003eethtool bitfield\n      ethtool: module: check fw_flash_in_progress under rtnl_lock\n      ethtool: module: fix cleanup if socket used for flashing multiple devices\n      ethtool: cmis: require exact CDB reply length\n      ethtool: cmis: fix u16-to-u8 truncation of msleep_pre_rpl\n      ethtool: cmis: validate start_cmd_payload_size from module\n      ethtool: cmis: validate fw-\u003esize against start_cmd_payload_size\n      ethtool: coalesce: cap profile updates at NET_DIM_PARAMS_NUM_PROFILES\n      ethtool: tsconfig: fix reply error handling\n      ethtool: linkstate: fix unbalanced ethnl_ops_complete() on PHY lookup error\n      ethtool: pse-pd: fix missing ethnl_ops_complete()\n      ethtool: tsconfig: fix missing ethnl_ops_complete()\n      ethtool: tsinfo: fix uninitialized stats on the by-PHC path\n      ethtool: tsinfo: don\u0027t pass ERR_PTR to genlmsg_cancel on prepare failure\n      ethtool: strset: fix header attribute index in ethnl_req_get_phydev()\n      ethtool: eeprom: add missing ethnl_ops_begin() / _complete() during fallback\n      ethtool: eeprom: add more safeties to EEPROM Netlink fallback\n      tools: ynl: add scope qualifier for definitions\n\nJamal Hadi Salim (1):\n      net/sched: Revert \"net/sched: Restrict conditions for adding duplicating netems to qdisc tree\"\n\nJan Volckaert (1):\n      USB: serial: option: add MeiG SRM813Q\n\nJanusz Krzysztofik (1):\n      drm/i915: Fix potential UAF in TTM object purge\n\nJason A. Donenfeld (1):\n      wireguard: send: append trailer after expanding head\n\nJassi Brar (1):\n      mailbox: Fix NULL message support in mbox_send_message()\n\nJeremy Erazo (1):\n      usb: gadget: composite: fix integer underflow in WebUSB GET_URL handling\n\nJeremy Kerr (1):\n      net: mctp: ensure our nlmsg responses are initialised\n\nJiayuan Chen (2):\n      ipv6: fix possible infinite loop in rt6_fill_node()\n      ipv6: fix possible infinite loop in fib6_select_path()\n\nJijie Shao (1):\n      net: hibmcge: disable Relaxed Ordering to fix RX packet corruption\n\nJingguo Tan (2):\n      vsock/virtio: bind uarg before filling zerocopy skb\n      xfrm: esp: restore combined single-frag length gate\n\nJohan Hovold (8):\n      USB: serial: safe_serial: fix memory corruption with small endpoint\n      USB: serial: omninet: fix memory corruption with small endpoint\n      USB: serial: keyspan: fix missing indat transfer sanity check\n      USB: serial: mxuport: fix memory corruption with small endpoint\n      USB: serial: mct_u232: fix missing interrupt-in transfer sanity check\n      USB: serial: cypress_m8: fix memory corruption with small endpoint\n      USB: serial: digi_acceleport: fix memory corruption with small endpoints\n      USB: serial: mct_u232: fix memory corruption with small endpoint\n\nJouni Högander (5):\n      drm/i915/psr: Add defininitions for INTEL_WA_REGISTER_CAPS DPCD register\n      drm/i915/psr: Read Intel DPCD workaround register\n      drm/i915/psr: Apply Intel DPCD workaround when SDP on prior line used\n      drm/i915/psr: Block DC states on vblank enable when Panel Replay supported\n      drm/i915/psr: Use DC_OFF wake reference to block DC6 on vblank enable\n\nJunrui Luo (1):\n      macsec: fix replay protection at XPN lower-PN wrap\n\nJustin Iurman (1):\n      ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo()\n\nKai Aizen (1):\n      usb: gadget: uvc: hold opts-\u003elock across XU walks in uvc_function_bind\n\nKim Seer Paller (1):\n      iio: dac: ad3530r: Fix AD3531/AD3531R powerdown mode strings\n\nKuniyuki Iwashima (1):\n      ip6: vti: Use ip6_tnl.net in vti6_changelink().\n\nLee Jones (3):\n      nfc: llcp: Fix use-after-free in llcp_sock_release()\n      nfc: llcp: Fix use-after-free race in nfc_llcp_recv_cc()\n      HID: wacom: Fix OOB write in wacom_hid_set_device_mode()\n\nLi Ming (1):\n      cxl/test: Update mock dev array before calling platform_device_add()\n\nLinpu Yu (1):\n      ipc: limit next_id allocation to the valid ID range\n\nLiu Kai (1):\n      HID: remove duplicate hid_warn_ratelimited definition\n\nLuiz Augusto von Dentz (1):\n      Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp\n\nLuka Gejak (1):\n      net: hsr: fix potential OOB access in supervision frame handling\n\nLukas Wunner (1):\n      platform/x86/intel/vsec: Fix enable_cnt imbalance on PCIe error recovery\n\nMaciej W. Rozycki (7):\n      serial: zs: Fix swapped RI/DSR modem line transition counting\n      serial: dz: Fix bootconsole message clobbering at chip reset\n      serial: dz: Fix bootconsole handover lockup\n      serial: dz: Convert to use a platform device\n      serial: zs: Fix bootconsole handover lockup\n      serial: zs: Switch to using channel reset\n      serial: zs: Convert to use a platform device\n\nMaoyi Xie (2):\n      ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate().\n      xfrm: route MIGRATE notifications to caller\u0027s netns\n\nMarc Harvey (2):\n      net: team: Remove unused team_mode_op, port_enabled\n      net: team: Rename port_disabled team mode op to port_tx_disabled\n\nMarco Scardovi (2):\n      gpio: rockchip: convert bank-\u003eclk to devm_clk_get_enabled()\n      gpio: rockchip: teardown bugs and resource leaks\n\nMatthew Maurer (1):\n      rust_binder: Avoid holding lock when dropping delivered_death\n\nMatthieu Baerts (NGI0) (1):\n      selftests: mptcp: drop nanoseconds width specifier\n\nMichael Bommarito (14):\n      smb: client: validate the whole DACL before rewriting it in cifsacl\n      l2tp: use refcount_inc_not_zero in l2tp_session_get_by_ifname\n      xfrm: ah: use skb_to_full_sk in async output callbacks\n      usbip: vudc: Fix use after free bug in vudc_remove due to race condition\n      usb: gadget: f_fs: copy only received bytes on short ep0 read\n      usb: gadget: f_fs: serialize DMABUF cancel against request completion\n      thunderbolt: property: Reject u32 wrap in tb_property_entry_valid()\n      thunderbolt: property: Reject dir_len \u003c 4 to prevent size_t underflow\n      scsi: fcoe: Reject FIP descriptors with zero fip_dlen in CVL walker\n      scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32\n      scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd()\n      scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf\n      drm/amdgpu: fix lock leak on ENOMEM in AMDGPU_GEM_OP_GET_MAPPING_INFO\n      thunderbolt: property: Cap recursion depth in __tb_property_parse_dir()\n\nMichael Roth (1):\n      KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use\n\nMichal Pecio (2):\n      usb: core: Fix up Interrupt IN endpoints with bogus wBytesPerInterval\n      usb: core: Fix SuperSpeed root hub wMaxPacketSize\n\nMikulas Patocka (1):\n      hpfs: fix a crash if hpfs_map_dnode_bitmap fails\n\nMingzhe Zou (1):\n      bcache: fix uninitialized closure object\n\nMinh Nguyen (1):\n      net: skbuff: fix missing zerocopy reference in pskb_carve helpers\n\nMuhammad Bilal (3):\n      Bluetooth: HIDP: fix missing length checks in hidp_input_report()\n      Bluetooth: ISO: fix UAF in iso_recv_frame\n      Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock\n\nMyeonghun Pak (1):\n      serial: altera_jtaguart: handle uart_add_one_port() failures\n\nMyrrh Periwinkle (2):\n      usb: typec: ucsi: Check if power role change actually happened before handling\n      usb: typec: ucsi: Don\u0027t update power_supply on power role change if not connected\n\nNathan Chancellor (1):\n      Disable -Wattribute-alias for clang-23 and newer\n\nNicolás Bazaes (1):\n      Input: synaptics - add LEN2058 to SMBus passlist for ThinkPad E490\n\nOliver Hartkopp (1):\n      bonding: refuse to enslave CAN devices\n\nOliver Neukum (1):\n      media: rc: ttusbir: fix inverted error logic\n\nPaolo Abeni (4):\n      mptcp: handle first subflow closing consistently\n      mptcp: borrow forward memory from subflow\n      mptcp: cleanup fallback dummy mapping generation\n      mptcp: reset rcv wnd on disconnect\n\nPavel Begunkov (1):\n      net: skbuff: fix pskb_carve leaking zcopy pages\n\nPavitra Jha (1):\n      Bluetooth: hci_conn: Fix memory leak in hci_le_big_terminate()\n\nPengpeng Hou (1):\n      iio: chemical: mhz19b: reject oversized serial replies\n\nPeter Chen (2):\n      usb: cdns3: plat: fix leaked usb2_phy initialization on usb3_phy acquisition failure\n      usb: cdns3: plat: fix unbalanced pm_runtime_forbid() call permanently leaks the runtime PM usage counter across bind/unbind cycles\n\nPeter Oberparleiter (1):\n      s390/cio: Restore GFP_DMA for CHSC allocation\n\nPrasanna S (1):\n      serial: qcom-geni: fix UART_RX_PAR_EN bit position\n\nPrathamesh Deshpande (1):\n      net/mlx5: HWS: Reject unsupported remove-header action\n\nPratyush Yadav (Google) (1):\n      memfd: deny writeable mappings when implying SEAL_WRITE\n\nQbeliw Tanaka (1):\n      Input: xpad - add \"Nova 2 Lite\" from GameSir\n\nQi Tang (1):\n      ipv6: validate extension header length before copying to cmsg\n\nQiang Ma (1):\n      KVM: arm64: PMU: Preserve AArch32 counter low bits\n\nQing Wang (1):\n      mm/slub: hold cpus_read_lock around flush_rcu_sheaves_on_cache()\n\nRadhey Shyam Pandey (1):\n      usb: dwc3: xilinx: fix error handling in zynqmp init error paths\n\nRadu Sabau (1):\n      iio: adc: ad4695: Fix call ordering in offload buffer postenable\n\nRafael J. Wysocki (2):\n      cpufreq: intel_pstate: Add and use hybrid_get_cpu_type()\n      cpufreq: intel_pstate: Use correct scaling factor on Raptor Lake-E\n\nRahul Chandelkar (1):\n      ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress()\n\nRobert Marko (1):\n      net: phy: micrel: fix LAN8814 QSGMII soft reset\n\nRodrigo Alencar (4):\n      iio: dac: ad5686: fix ref bit initialization for single-channel parts\n      iio: dac: ad5686: fix input raw value check\n      iio: dac: ad5686: acquire lock when doing powerdown control\n      iio: dac: ad5686: fix powerdown control on dual-channel devices\n\nSalah Triki (4):\n      iio: dac: max5821: fix return value check in powerdown sync\n      iio: adc: mt6359: fix unchecked return value in mt6358_read_imp\n      iio: adc: viperboard: Fix error handling in vprbrd_iio_read_raw\n      iio: temperature: tsys01: fix broken PROM checksum validation\n\nSam Burkels (1):\n      usb: storage: Add quirks for PNY Elite Portable SSD\n\nSanjay Chitroda (1):\n      iio: ssp_sensors: cancel delayed work_refresh on remove\n\nSanthosh Kumar K (1):\n      spi: spi-mem: avoid mutating op template in spi_mem_supports_op()\n\nSean Christopherson (8):\n      KVM: SVM: Flush the current TLB when transitioning from xAVIC \u003d\u003e x2AVIC\n      KVM: SEV: Ignore Port I/O requests of length \u00270\u0027\n      KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests\n      KVM: SEV: WARN if KVM attempts to setup scratch area with min_len\u003d\u003d0\n      KVM: SEV: Compute the correct max length of the in-GHCB scratch area\n      KVM: SEV: Check PSC request indices against the actual size of the buffer\n      KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer\n      KVM: SEV: Don\u0027t explicitly pass PSC buffer to snp_begin_psc()\n\nSean Shen (1):\n      ksmbd: fix FSCTL permission bypass by adding a permission check for FSCTL_SET_SPARSE\n\nSean Young (1):\n      media: rc: fix race between unregister and urb/irq callbacks\n\nSebastian Reichel (1):\n      usb: typec: tcpm: improve handling of DISCOVER_MODES failures\n\nSeongJae Park (1):\n      mm/damon/sysfs-schemes: delete tried region in regions_rmdirs()\n\nSeungjin Bae (1):\n      usb: gadget: dummy_hcd: Reject hub port requests for non-existent ports\n\nShaomin Chen (1):\n      xfrm: iptfs: reset runtime state when cloning SAs\n\nShardul Bankar (1):\n      mptcp: do not drop partial packets\n\nShitalkumar Gandhi (1):\n      serial: fsl_lpuart: fix rx buffer and DMA map leaks in start_rx_dma\n\nShuai Zhang (3):\n      Bluetooth: btusb: Allow firmware re-download when version matches\n      Bluetooth: hci_qca: Use 100 ms SSR delay for rampatch and NVM loading\n      Bluetooth: hci_qca: Convert timeout from jiffies to ms\n\nSiwei Zhang (2):\n      Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen()\n      Bluetooth: L2CAP: fix chan ref leak in l2cap_chan_timeout() on !conn\n\nSrinivas Kandagatla (3):\n      ASoC: qcom: q6asm-dai: fix error handling in prepare and set_params\n      ASoC: qcom: q6asm-dai: close stream only when running\n      ASoC: qcom: q6asm-dai: do not set stream state in event and trigger callbacks\n\nStepan Ionichev (1):\n      auxdisplay: line-display: fix OOB read on zero-length message_store()\n\nStephen J. Fuhry (1):\n      USB: quirks: add NO_LPM for Lenovo ThinkPad USB-C Dock Gen2 hub controllers\n\nSteve French (1):\n      smb: client: fix uninitialized variable in smb2_writev_callback\n\nSvyatoslav Ryhel (1):\n      iio: Fix iio_multiply_value use in iio_read_channel_processed_scale\n\nThomas Fourier (1):\n      Input: ims-pcu - fix usb_free_coherent() size in ims_pcu_buffers_free()\n\nTimur Kristóf (1):\n      drm/amd/pm/si: Disregard vblank time when no displays are connected\n\nTom Lendacky (1):\n      x86/mm: Disable broadcast TLB flush when PCID is disabled\n\nTudor Ambarus (1):\n      tty: serial: samsung: Remove redundant port lock acquisition in rx helpers\n\nUsama Arif (1):\n      xfrm: move policy_bydst RCU sync from per-netns .exit to .pre_exit\n\nUwe Kleine-König (2):\n      serdev: Provide a bustype shutdown function\n      Bluetooth: hci_qca: Migrate to serdev specific shutdown function\n\nVictor Nogueria (1):\n      net/sched: sch_sfb: Replace direct dequeue call with peek and qdisc_dequeue_peeked\n\nViken Dadhaniya (1):\n      serial: qcom_geni: fix kfifo underflow when flush precedes DMA completion IRQ\n\nWanquan Zhong (1):\n      USB: serial: option: add missing RSVD(5) flag for Rolling RW135R-GL\n\nWei-Cheng Chen (1):\n      xhci: tegra: Fix ghost USB device on dual-role port unplug\n\nWeiming Shi (3):\n      tun: free page on short-frame rejection in tun_xdp_one()\n      tun: free page on build_skb failure in tun_xdp_one()\n      net: team: fix NULL pointer dereference in team_xmit during mode change\n\nWentao Guan (1):\n      USB: cdc-acm: Fix bit overlap and move quirk definitions to header\n\nWentao Liang (1):\n      usb: musb: omap2430: Fix use-after-free in omap2430_probe()\n\nXiaolei Wang (1):\n      misc: rp1: Send IACK on IRQ activate to fix kdump/kexec\n\nXu Yang (1):\n      usb: chipidea: core: convert ci_role_switch to local variable\n\nYongchao Wu (1):\n      usb: cdns3: gadget: fix request skipping after clearing halt\n\nYuqi Xu (1):\n      bpf: sockmap: fix tail fragment offset in bpf_msg_push_data\n\nZeng Heng (1):\n      arm64: tlb: Flush walk cache when unsharing PMD tables\n\nZhang Cen (2):\n      USB: serial: belkin_sa: validate interrupt status length\n      USB: serial: cypress_m8: validate interrupt packet headers\n\nZhang Heng (1):\n      ALSA: hda/realtek: Fix speaker output on ASUS ROG Strix G615LP\n\nZhao Dongdong (1):\n      Bluetooth: 6lowpan: check skb_clone() return value in send_mcast_pkt()\n\nZhaoyang Yu (1):\n      tty: serial: pch_uart: add check for dma_alloc_coherent()\n\nZhengchuan Liang (2):\n      ipv6: exthdrs: refresh nh after handling HAO option\n      xfrm: input: hold netns during deferred transport reinjection\n\nZhenghang Xiao (3):\n      Bluetooth: l2cap: clear chan-\u003eident on ECRED reconfiguration success\n      sctp: fix race between sctp_wait_for_connect and peeloff\n      drm/gem: fix race between change_handle and handle_delete\n\nZiyi Guo (1):\n      drm/amdgpu: check num_entries in GEM_OP GET_MAPPING_INFO\n\nZiyu Zhang (1):\n      vsock: keep poll shutdown state consistent\n\nhlleng (1):\n      HID: quirks: Add ALWAYS_POLL quirk for SIGMACHIP USB mouse\n\nBUG\u003db/522164828\nTEST\u003dtryjob, validation and K8s e2e\nRELEASE_NOTE\u003dUpdated the Linux kernel to v6.18.35.\n\nChange-Id: I22b2ae572d18d1a8dd8e8f9c2375f712f0d35797\nSigned-off-by: Kevin Berry \u003ckpberry@google.com\u003e\nReviewed-on: https://cos-review.googlesource.com/c/third_party/kernel/+/159207\nReviewed-by: Derek Taylor \u003cddtaylor@google.com\u003e\nTested-by: Cusky Presubmit Bot \u003cpresubmit@cos-infra-prod.iam.gserviceaccount.com\u003e\nReviewed-by: Mina Almasry \u003calmasrymina@google.com\u003e\n",
  "tree_diff": []
}